Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-115216: Eclipse ioFog Operator may expose admin credentials to attackers
CVE-2026-115216 · published today
Summary
Versions of the Eclipse ioFog Operator between 3.8.0 and 3.9.1 do not check the security certificates when they talk to the Controller or an external login service. This lets a person who can intercept the connection present a fake certificate and steal the admin password or client secret used by the Operator. Upgrade to version 3.9.2 or later, or apply a configuration change that re‑enables certificate verification, to stop the risk.
What to do
- Update eclipse foundation eclipse iofog to version 3.9.2 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| eclipse foundation | eclipse iofog | < 3.9.2 |
Original advisory text
Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret (external mode) or the Controller bootstrap admin password (embedded mode with Controller HTTPS enabled), and supply the access token the operator stores for later Controller API calls. v3.8 removed Keycloak. The exposed credential is not a Keycloak realm-admin secret.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-295Improper Certificate Validation
Timeline
Published27 Oct 2026
Updated27 Oct 2026
First seen27 Oct 2026
Track software like this
Free during beta